2

scrypt was designed to use more memory. We can use its parameters to specify (approximately) how much memory we want it to require.

But both scrypt and PBKDF2 allow us to specify the output data size.

So my question is, can't we also make PBKDF2 use a lot of memory by simply asking it for a large output (and taking the bytes we actually need from the end of output, discarding the rest)?

If this is the case, then what's the point of scrypt?

If this is not the case (which is more likely), please tell me what's wrong with my thinking.

3

Each block of the output of PBKDF2 is derived independently of all the other blocks. Because of this, computing a large output on a massively parallel system (such as a GPU) is very efficient. Further, if you only take certain bytes of the output and discard the rest, an attacker only needs to compute the blocks containing those bytes.

0

We can't "also make PBKDF2 use a lot of memory by simply asking it for a
large output (and taking the bytes we actually need from the end of output,
discarding the rest)" because PBKDF2 can essentially stream its output.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.